New Employer Guidelines on Personal Information - International Law Office

Background
Personal Information Protection Law
Main Obligations

Background

Until recently, Japan had no legislation directly regulating the protection of employee personal information. However, personal information under privacy rights is protected as a fundamental human right guaranteed in the Constitution. Therefore, if an employer maliciously or unreasonably uses or discloses any of its employees' personal information, the employer may be liable on tort or contractual grounds under the Civil Code.

On December 20 2000 the Ministry of Labour (now the Ministry of Health, Labour and Welfare) responded to the increased need to protect personal information by announcing Guidelines on the Protection of Employee Personal Information. These guidelines are not legally binding, but the ministry strongly has been recommending that all companies follow them. It was also likely that the guidelines would be used for guidance purposes where there was a need to determine whether an employer mishandled employee personal information and would be subject to liability.

Personal Information Protection Law

The Personal Information Protection Law was enacted in 2003. The law refers not only to the employer's obligation to protect its employees' personal information, but also to personal information collected and retained by third parties in general.

The provisions of the law applicable to government functions, including public officers, came into effect in 2003. The remaining provisions, applicable to private enterprises, will come into effect on April 1 2005. These include regulations that employers are required to comply with when handling employees' personal information.

To complement the law's enactment, on July 1 2004 the Ministry of Health, Labour and Welfare announced new guidelines to specify employer obligations under the law. The guidelines include Measures for Employers to Ensure Appropriate Handling of Employee Management-Related Personal Information. The new guidelines will also become effective on April 1 2005.

The Personal Information Protection Law and the new guidelines apply only to employers dealing with personal information for 5,000 or more employees. Therefore, affected employers must ensure that they understand their fundamental obligations to comply with the law and the guidelines.

Employers with fewer than 5,000 employees may, if they desire, ignore implementation of the law and the new guidelines. However, the previous guidelines are still in full force and have not been rescinded.

Main Obligations

The fundamental obligations under the law and the new guidelines are as follows:

• Where dealing with employees' personal information, employers must specify the purpose of using the information on a case-by-case basis (Article 15);
  
  
• Where collecting employees' personal information, employers must notify employees of the purpose of collection, either in advance or immediately after the data is collected (Article 18);
  
  
• Employers may not use employees' personal information except for the purpose specified, unless prior consent has been obtained from employees (Article 16);
  
  
• Employers may not collect employees' personal information using inappropriate measures such as misrepresentation (Article 17);
  
  
• Employers must take appropriate measures to protect employees' personal information from disclosure or becoming lost (Article 20), which includes limiting those permitted to handle personal information to appropriate employees with the necessary knowledge and experience. Employers must notify the selected employees of their limited authorization in advance, training them and ensuring that they maintain personal information strictly in confidence, either during or after employment;
  
  
• When engaging a third party to maintain employees' personal information, employers must ensure that the personal information is properly protected (Article 22) by specifying the terms of engagement regarding measures to maintain the data, sub-engagement conditions, the term of engagement, disposition of data and so on;
  
  
• Employers may not disclose employees' personal information to a third party without prior consent from employees (Article 23). When transferring employees' personal information to a third party, employers must ensure that it is appropriately protected by specifying the terms of information transfer with regard to maintaining data, sub-transfer conditions, the term of possession, disposition of data and so on; and
  
  
• Employers must ensure that employees know the purpose of maintaining the employees' personal information (Article 24). If requested, employers must notify employees in writing of any personal information maintained (Article 25).

Employers that do not comply with the new law may be subject to recommendations, instructions or orders by the Ministry of Health, Labour and Welfare. If employers do not follow the direction of the ministry, they may be subject to a jail sentence of up to six months or a fine of up to Y300,000. Administrative action has no effect on the civil liabilities of employers.

For further information on this topic please contact Yasuhiro Fujii at Tokyo Aoyama Aoki Law Office/Baker & McKenzie by telephone (+81 3 5157 2700) or by fax (+81 3 5157 2900) or by email (yasuhiro.fujii@bakernet.com).